Twitter Video Download

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:12 PM UTC
• Version: 1.0.2

Overview

The skill does what it claims, but it weakens download security by disabling TLS certificate checks and may expose proxy credentials in logs.

Review before installing. The skill is not showing deception or destructive behavior, but users should avoid proxy URLs with embedded credentials, expect downloads to be written to the chosen path, and prefer a version that removes the default TLS certificate bypass and pins yt-dlp.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download.mjs:100
• Finding: TLS Certificate Verification Disabled for All Downloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download.mjs`, lines 100–106 **Vulnerability Type**: Improper certificate validation **Risk Level**: Medium ### Vulnerable Code ```js const ydlArgs = [ '-f', `${quality}[ext=mp4]/best`, '--output', outputTemplate, '--no-warnings', '--socket-timeout', '30', '--no-check-certificate' // Only if needed for proxy ]; ``` ### Technical Analysis The script unconditionally passes `--no-check-certificate` to `yt-dlp`. This disables TLS certificate verification for every download, even when no proxy is configured. TLS certificate validation establishes that the remote endpoint is the intended Twitter/X service. Disabling it allows an attacker who controls or can intercept the network path to present an untrusted certificate without causing the connection to fail. The inline comment indicates that this behavior was intended only for exceptional proxy configurations, but the option is always enabled. ### Attack Path 1. A user invokes the Skill to download media from an HTTPS Twitter/X URL. 2. The script starts `yt-dlp` with `--no-check-certificate`. 3. An attacker controls the configured proxy, local network, DNS resolution, or another relevant network component. 4. The attacker intercepts the HTTPS connection and presents an invalid or attacker-controlled certificate. 5. Because certificate verification is disabled, `yt-dlp` accepts the connection. 6. The attacker can observe or modify extractor responses and downloaded content before it is written to the selected output directory. ### Impact Assessment Successful exploitation does not directly grant additional local operating-system privileges. It compromises the confidentiality and integrity of network traffic handled by `yt-dlp`. An attacker positioned on the network path may observe requests, manipulate responses, or substitute downloaded media within the scope of the download operation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Remove `--no-check-certificate` from the default argument list and rely on normal TLS certificate validation: ```js const ydlArgs = [ '-f', `${quality}[ext=mp4]/best`, '--output', outputTemplate, '--no-warnings', '--socket-timeout', '30' ]; ``` If disabling validation is unavoidable in a particular environment: 1. Require an explicit command-line option or dedicated environment variable. 2. Keep the insecure mode disabled by default. 3. Display a prominent warning when it is enabled. 4. Prefer configuring the correct private certificate authority rather than bypassing verification. 5. Document that the option exposes traffic to interception and content substitution. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–15 **Vulnerability Type**: Mutable and unverified dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install yt-dlp pip install yt-dlp ``` ### Technical Analysis The installation instructions retrieve `yt-dlp` without pinning a reviewed version or verifying package integrity. Consequently, the effective dependency installed by users can change after the Skill itself has been audited. This creates supply-chain exposure if a future upstream release, package-index account, package repository, or dependency-resolution environment is compromised. The finding does not establish that the current `yt-dlp` package is malicious; it identifies the absence of controls ensuring that users receive the same reviewed dependency. ### Attack Path 1. An attacker compromises an upstream release process, package-index account, package repository, or relevant dependency-distribution path. 2. The attacker publishes or serves a malicious or modified package version. 3. A user follows the documented `pip install yt-dlp` instruction. 4. `pip` resolves the mutable package name to the attacker-controlled or compromised release. 5. Package installation behavior or subsequent execution of `yt-dlp` runs malicious code with the privileges of the installing or invoking user. ### Impact Assessment If the dependency distribution channel is compromised, malicious code may execute with the current user's privileges. Its practical scope could include access to files, environment variables, network resources, and output directories available to that user. System-level privileges would only be available if the user performs installation or execution from a privileged account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `yt-dlp` to a specific version that has been reviewed and tested. 2. Store the dependency declaration in a lock or requirements file. 3. Require cryptographic hash verification, for example with `pip --require-hashes`. 4. Review and deliberately update the pinned version instead of automatically accepting every new release. 5. Use a trusted package index explicitly where the deployment environment permits it. 6. Avoid recommending privileged installation unless it is strictly necessary. Example structure: ```text yt-dlp==<reviewed-version> --hash=sha256:<verified-package-hash> ``` Then install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download.mjs:110
• Finding: Proxy Credentials Exposed Through Console Logging<![CDATA[ ## Vulnerability Details **File Location**: `scripts/download.mjs`, lines 110–116 **Vulnerability Type**: Sensitive information exposure through logs **Risk Level**: Medium ### Vulnerable Code ```js const proxy = process.env.PROXY_URL; if (proxy) { // Validate proxy URL format if (proxy.startsWith('http://') || proxy.startsWith('https://') || proxy.startsWith('socks5://')) { ydlArgs.push('--proxy', proxy); console.log(`Using proxy: ${proxy}`); } else { ``` ### Technical Analysis Proxy URLs can contain embedded authentication information, such as: ```text http://username:[e-mail]:8080 ``` The script prints the complete `PROXY_URL` value to standard output. The process uses inherited standard I/O, so this output may be retained in Agent transcripts, CI logs, terminal captures, monitoring systems, or other execution records. The protocol-prefix check only confirms that the value begins with an accepted scheme. It does not parse the URL, validate its complete structure, or redact embedded usernames and passwords before logging. ### Attack Path 1. A user configures `PROXY_URL` with embedded credentials. 2. The user or Agent invokes the download script. 3. The script reads the environment variable and prints the complete proxy URL using `console.log`. 4. The execution environment captures standard output in a transcript or log. 5. A person or service with access to that log obtains the proxy username and password. 6. The exposed credentials may be used to access the proxy within the permissions and lifetime assigned to that account. ### Impact Assessment The vulnerability exposes proxy authentication credentials rather than directly granting local system privileges. An attacker who obtains the logs may gain the network access available to the proxy account, consume proxy resources, impersonate the user to the proxy, or observe activity attributable to that account. The scope depends on the proxy's authorization policy ...[truncated 54 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never print the complete proxy URL. 2. Parse the value with the standard `URL` class. 3. Validate the protocol, hostname, and port using parsed fields rather than string-prefix checks. 4. Log only a redacted endpoint that excludes credentials. 5. Avoid including secrets in thrown errors or diagnostic output. 6. Rotate any proxy credentials that may already have appeared in retained logs. Example: ```js const proxy = process.env.PROXY_URL; if (proxy) { try { const parsedProxy = new URL(proxy); const allowedProtocols = new Set(['http:', 'https:', 'socks5:']); if (!allowedProtocols.has(parsedProxy.protocol) || !parsedProxy.hostname) { throw new Error('Unsupported proxy URL'); } ydlArgs.push('--proxy', proxy); const redactedEndpoint = `${parsedProxy.protocol}//${parsedProxy.hostname}` + `${parsedProxy.port ? `:${parsedProxy.port}` : ''}`; console.log(`Using proxy: ${redactedEndpoint}`); } catch { console.warn('Warning: PROXY_URL is invalid or unsupported'); } } ``` ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script always adds yt-dlp's --no-check-certificate option, which disables TLS certificate validation for all downloads. That makes HTTPS connections susceptible to man-in-the-middle interception or content tampering, especially on hostile networks or when a proxy is used, and the comment is misleading because the behavior is unconditional.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

'--output', outputTemplate,
    '--no-warnings',
    '--socket-timeout', '30',
    '--no-check-certificate'  // Only if needed for proxy
  ];

  // Add proxy if set (environment variable)

• Confidence: 96% confidence
• Finding: Using the tool parameter --no-check-certificate weakens the security guarantees of the downstream tool by disabling server certificate verification. In this skill's context, the only job is downloading media from a specific site, so weakening transport validation is unnecessary and increases the risk of accepting tampered content or connecting through an attacker-controlled TLS endpoint.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares an environment-variable dependency (`PROXY_URL`) in metadata but does not declare an explicit tool scope such as `permissions` or `allowed-tools`. That creates an implicit capability boundary where the agent may access environment-derived network configuration without a clearly documented permission model, reducing reviewability and increasing the chance of unintended secret or network-use exposure.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The manifest describes a narrowly scoped skill that downloads a video from a provided Twitter/X URL to a specified location. Reading process environment for PROXY_URL introduces an extra capability to consume external runtime configuration, which is not mentioned in the manifest and is not necessary to understand from the stated user-facing purpose.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file states that the skill downloads content to local storage and supports custom save paths and filenames, which affects user data on disk. Under the markdown-specific warning criterion, the description should disclose file-write behavior and any overwrite/location implications, but no such warning is present in the usage or description sections.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/download.mjs:7